점검 대응높음KEV 미등록
CVE-2026-27896
modelcontextprotocol go-sdk, Migration Toolkit for Virtualization, OpenShift Lightspeed 취약점
The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prior to 1.3.1. Go's standard library performs case-insensitive matching of JSON keys to struct field tags — a field tagged json:"method" would also match "Method", "METHOD", etc. This violated the JSON-RPC 2.0 specification, which defines exact field names. A malicious MCP peer may have been able to send protocol messages with non-standard field casing that the SDK would silently accept. This had the potential for bypassing intermediary inspection and coss-implementation inco...
- 대응 우선순위
- 점검
- CVSS
- 7
- EPSS
- 0.26% 백분위 17.0% · 2026.08.04 기준
- CISA KEV
- 미등록
- 조치 기한
- -
- 공개일
- 2026.02.26